This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.
A playbook is roles and a clock
An incident is a named problem with a start time, a severity, and a person who owns the next hour. The plan generator drafts those headings. The severity calculator turns impact into a level. You still decide. This page does not describe how to cause an incident.
Containment is something you can undo on a system you administer: disable an account, isolate a host you own, revoke a key, take a site back to a known page. Wiping a disk before you have the logs your policy told you to keep is not containment. Paying a criminal is not a step in this playbook.
The scenario guides are the specific first hours: ransomware, phishing, a leaked key, a lost laptop. This page is the shape they all share. Legal notice, customers, and regulators are decisions for counsel and the privacy guide, not a paragraph you improvise.
Practice on the lab. The first time you isolate a host should not be the production database.
A lab incident you declare and then close
Declare a lab incident at a clock time you write down. Severity is whatever the calculator and your sentence agree. The owner is you, and a second name is the person you would call. Containment is isolating a lab host or disabling a lab account. Undo it. The undo is part of the drill.
Write three lines: what you think happened, what you did, what you will check next. Stop. A drill that becomes a real investigation of production is a scope failure.
The communications line says who is told inside the team. It does not say you email the whole company from a half-written note.
Close the lab incident when the account or host is back, and keep the timeline. That timeline is the template.
A change you can finish
A real incident uses this shape and the scenario guide that matches. You do not invent a new process at the start.
Rollback of a containment is the undo you practised, used when the owner says the containment is no longer needed.
- Write the clock time and the severity.
- Name the owner and the next person.
- Contain only the system you administer, in a way you can undo.
- Preserve the logs you already have if policy says to keep them.
- Pick the scenario guide that matches.
- Keep customer and legal notice with counsel.
- Close with a timeline and one follow-up change.
Mistakes that outlive the command
incident response fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.
- No clock and no owner.
- Wiping evidence because it feels cleaner.
- A payment link treated as a recovery step.
- Emailing everyone before the facts fit in three lines.
- Containment you cannot undo and did not practise.
- Working the production system as if it were the drill.
- A severity argument that delays the first containment.
- Skipping the scenario guide and improvising exploit-shaped steps.
Decisions to write down before the window
Decision 1 for incident response. Every incident has a start time, a severity, and an owner. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 2 for incident response. Containment is reversible and was practised in the lab. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 3 for incident response. Logs your policy keeps are preserved. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 4 for incident response. The matching scenario guide is opened. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 5 for incident response. Counsel owns external notice. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 6 for incident response. Payment is not a step. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 7 for incident response. The timeline is the record. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 8 for incident response. The drill used a lab account or a lab host. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 9 for incident response. Rollback of containment is written. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 10 for incident response. One follow-up change is filed after close, not during the first hour. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
The hour you stop
Write the hostname or the system name, the owner, and the clock time before you change anything for incident response. If the system is serving people and you do not have a spare, this hour is a plan, not a change. A plan you can read tomorrow is a success. A change you cannot undo is not.
Use a lab or a copy. The log line you test with is one you created, or one you are already allowed to hold. You do not point a tool at a network, a mailbox, or an account you do not administer. The tools on this site run in the browser. They do not log in, and they do not scan.
prompt-for-this is a reminder that a secret is missing. It is not a password, a token, or a key you save. The real secret stays in the password store. If a draft, a log, or a ticket still contains a live secret, stop and rotate it. Then delete the copy.
One change. A firewall, a detection, a DNS record, and a policy do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous value, written down while the system still works.
A second person reads the scope aloud: which host, which domain, which account. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.
Documentation addresses stay in the lab. 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 are not your production network. example.com is not your domain. Replace them before a real record or a real rule is published.
Do not allow every address because a test failed. A rule, a header, or a detection that matches the world is a draft you delete. Management stays on the prefix you named. A service port opens when the service is ready, for the clients you named.
Keep the previous file. A generator draft is not the previous file. The previous file is what you reload if the new one is wrong. You practised the reload on the lab, with a console or a second session open when the change can lock you out.
If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied config produces a system nobody can explain. Rebuild the lab from the copy you kept.
When the checks pass, the next system waits until someone else can repeat the proof from the notes. incident response is done for this window when the proof is written, not when the tool printed a file.
This page is a planning guide. It is not legal advice, not an audit opinion, not a vendor manual, and not the text of a standard. If a lawyer, an auditor, or a regulator must see the decision, they see the ticket and the evidence, not this paragraph.
Hand the finished note to the neighbouring guide that owns the next step, and leave this system alone until that guide has its own window.
Incident checks before you call the first hour finished
Check 1 in Incident checks before you call the first hour finished. The start time is written. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 2 in Incident checks before you call the first hour finished. The owner is named. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 3 in Incident checks before you call the first hour finished. Severity is a level you can say aloud. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 4 in Incident checks before you call the first hour finished. Containment targets a system you administer. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 5 in Incident checks before you call the first hour finished. You know how to undo it. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 6 in Incident checks before you call the first hour finished. Required logs were not wiped. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 7 in Incident checks before you call the first hour finished. The scenario guide is the one that matches. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 8 in Incident checks before you call the first hour finished. No payment and no exploit steps are in the timeline. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 9 in Incident checks before you call the first hour finished. External notice is assigned to counsel if it exists at all. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 10 in Incident checks before you call the first hour finished. The lab drill was closed with an undo. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 11 in Incident checks before you call the first hour finished. A second person can repeat the three lines. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 12 in Incident checks before you call the first hour finished. A follow-up ticket exists or is explicitly none. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 13 in Incident checks before you call the first hour finished. The hostname in the prompt matches the hostname in the ticket for incident response. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 14 in Incident checks before you call the first hour finished. The result line includes the time and the person, not only the command. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 15 in Incident checks before you call the first hour finished. You can point at the rollback value without searching a chat history. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 16 in Incident checks before you call the first hour finished. Done is a sentence a second person can repeat: the proof for incident response happened, and the next host is not started early. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Tools for this guide
These tools run in the browser on this site. They do not log into your machines.
Related pillar guides
Guides in this cluster
These supporting pages belong to this pillar. A published page is linked. The others are named until they are published.
- How-To: How to Write an Incident Response Plan
- Explainer: Incident Severity Levels Explained
- How-To: Building an Incident Timeline
- How-To: Evidence Handling and Chain of Custody
- How-To: Live Response and Memory Acquisition
- Reference: Breach Notification Deadlines by Law
- Explainer: How Much Does a Breach Cost?
- Checklist: Ransomware Readiness Checklist
- How-To: Running a Tabletop Exercise
- How-To: Writing a Post-Incident Report
The content plan also names a companion in another desk: System: Ransomware Recovery Plan.